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SUBJECT:  Quality  Control  Review  of  the  Grant  Thornton,  LLP,  FY  2011  Single  Audit  of  the  Henry  M.  Jackson 
Foundation  for  the  Advancement  of  Military  Medicine  (Report  No.  DODIG-2013-124) 

We  are  providing  this  report  for  your  information  and  use.  As  the  cognizant  Federal  agency  for  the 
Henry  M.  Jackson  Foundation  for  the  Advancement  of  Military  Medicine,  we  began  a  review  of  the 
Grant  Thornton,  LLP  single  audit  and  supporting  work  papers  for  the  year  ended  September  30,  2011. 
The  purpose  of  our  review  was  to  determine  whether  the  single  audit  was  conducted  in  accordance  with 
government  auditing  standards,  the  American  Institute  of  Certified  Public  Accountants'  auditing  standards, 
and  the  auditing  and  reporting  requirements  of  Office  of  Management  and  Budget  Circular  A-133,  “Audits  of 
States,  Local  Governments,  and  Non-Profit  Organizations." 

We  discontinued  our  quality  control  review  after  we  learned  a  staff  auditor  had  falsified  workpapers; 
therefore,  the  audit  report  opinion  on  compliance  with  requirements  on  the  Federal  program  cannot  be 
relied  on.  Grant  Thornton,  LLP  needs  to  perform  additional  audit  procedures  to  support  the  audit 
conclusions  and  overall  audit  opinion.  We  will  reschedule  our  review  once  the  additional  audit  work 
is  completed  and  the  audit  report  is  resubmitted  to  the  Federal  Audit  Clearinghouse. 

We  considered  management  comments  on  the  draft  of  this  report.  The  management  comments  were 
responsive;  therefore,  additional  comments  are  not  required. 


We  appreciate  the  courtesies  extended  to  the  audit  staff.  For  additional  information  on  this  report,  please 
contact  Ms.  Carolyn  R.  Davis  at  (703)  604-8877  (DSN  664-8877). 


Randolph  R.  Stone 
Deputy  Inspector  General 
Policy  and  Oversight 
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Introduction 


Objective 

As  the  cognizant  Federal  agency  for  the  Henry  M.  Jackson  Foundation  for  the  Advancement 
of  Military  Medicine  (the  Foundation),  we  began  a  review  of  the  Grant  Thornton  LLP 
(Grant  Thornton),  single  audit  and  supporting  working  papers  for  the  audit  period 
October  1,2010  through  September  3  0, 20 1 1.  The  purpose  of  our  review  was  to  determine 
whether  the  single  audit  was  conducted  in  accordance  with  auditing  standards1  and  the 
auditing  and  reporting  requirements  of  the  Office  of  Management  and  Budget  (OMB) 
Circular  A-133,  "Audits  of  States,  Local  Governments,  and  Non-Profit  Organizations," 
(Circular  A-133).  Appendix  A  contains  additional  criteria,  scope,  and  methodology 
of  the  review;  and  Appendix  B  lists  the  compliance  requirements  that  Grant  Thornton 
determined  to  be  applicable  to  the  FY  2011  audit. 

Background 

The  Foundation  is  a  not-for-profit  organization  authorized  by  Congress  in  May  1983  to 
support  military  medical  research.  The  Foundation  administers,  manages,  and  supports 
scientific  programs  that  benefit  members  of  the  armed  forces  and  civilians.  During 
FY  2011,  the  Foundation  expended  $398.4  million  in  Federal  awards,  under  one  Federal 
program,  the  research  and  development  cluster.  Of  the  $398.4  million,  $335.9  million  was 
expended  for  Department  of  Defense  programs. 

Review  Results 

We  discontinued  our  quality  control  review  due  to  the  determination  that  some  of  the 
Grant  Thornton  work  papers  could  not  be  relied  on  and,  therefore,  neither  could  the  audit 
report  opinion  on  compliance  with  requirements  on  the  Federal  program.  Grant  Thornton 
needs  to  perform  additional  audit  procedures  to  support  the  audit  conclusions  and  overall 
audit  opinion  (Finding  A).  We  will  reschedule  our  review  once  the  additional  audit  work 
is  completed  and  the  audit  report  is  resubmitted  to  the  Federal  Audit  Clearinghouse. 

Although  we  are  discontinuing  our  review,  we  identified  an  issue  with  Grant  Thornton's 
sampling  policy  that  needs  to  be  addressed  to  ensure  the  audit  procedures  performed  for 
all  single  audits  are  sufficient  to  support  the  opinion  on  compliance  with  requirements  on 
Federal  programs  (Finding  B). 


1  Auditing  standards  include  both  government  auditing  standards  and  the  American  Institute  of  Certified  Public  Accountants' 
audit  standards. 
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Management  Comments  and  DoDIG  Response 

The  National  Managing  Partner,  Professional  Standards  Group,  Grant  Thornton,  LLP, 
agreed  to  take  the  recommended  actions.  Management  comments  were  responsive  and 
conform  to  requirements;  no  additional  comments  are  needed.  Management  comments 
are  included  in  their  entirety  at  the  end  of  this  report. 


2  |  DODIG-2013-124 


Finding  A 


Finding  A 

Performance  of  Federal  Program  Audit 

Grant  Thornton  reviewed  a  sample  of  transaction  items  to  evaluate  the  Foundation's 
compliance  with  applicable  compliance  requirements.  We  performed  re-testing  of  several 
transaction  items  included  in  the  sample  to  determine  whether  the  audit  procedures 
performed  were  sufficient  to  support  audit  conclusions.  The  re-testing  consisted  of 
examining  the  source  documents  reviewed  by  the  Grant  Thornton  auditors.  As  a  result  of 
our  analysis,  we  detected  several  irregularities  and  requested  additional  information  and 
clarification  from  Grant  Thornton  auditors.  In  response  to  our  inquiries,  Grant  Thornton 
performed  further  research  and  determined  that  some  items  in  the  sample  were  not  part 
of  the  Foundation's  transactions  for  FY  2011.  Grant  Thornton  informed  us  that  one  staff 
auditor  falsified  work  papers  by  copying  transactions  from  the  prior  year  single  audit 
and  changing  the  dates  of  the  transactions  to  make  them  appear  to  be  FY  2011 
transactions.  These  false  transactions  were  included  in  the  sample  used  for  several 
compliance  requirements.  Due  to  the  seriousness  of  the  situation,  Grant  Thornton  stated 
that  they  were  investigating  the  matter,  had  terminated  the  auditor  who  falsified  work 
papers,  and  were  performing  additional  audit  work  to  support  its  audit  opinion  on  the 
Foundation's  FY  2011  single  audit. 


Recommendations,  Management  Comments,  and  Our 
Response 

Recommendation  A 

We  recommend  that  the  National  Managing  Partner,  Professional  Standards  Group, 
Grant  Thornton,  LLP,  provide  the  DoD  Office  of  Inspector  General  with: 

1.  The  results  of  the  Grant  Thornton  investigation  into  the  matter  of  the  falsified 
work  papers, 

2.  A  list  of  all  Circular  A-133  audits  and  any  audits  impacting  DoD  on  which  the 
Grant  Thornton  auditor  who  falsified  work  papers  was  assigned, 

3.  The  role  of  the  auditor  and  any  specific  actions  taken  on  the  audit(s)  identified 
above,  and 
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Grant  Thornton  Comments 

The  National  Managing  Partner,  Professional  Standards  Group,  Grant  Thornton,  LLP, 
agreed  to  provide  the  requested  information  for  Recommendations  A.l,  A.2,  and  A.3  by 
September  15,  2013. 

Our  Response 

Grant  Thornton  comments  were  responsive  to  the  recommendations.  No  additional 
comments  are  needed. 

4.  Any  corrective  actions  taken,  including  changes  to  Grant  Thornton’s 
supervisory  review  process  and  overall  quality  control  procedures. 

Grant  Thornton  Comments 

The  National  Managing  Partner,  Professional  Standards  Group,  Grant  Thornton,  LLP, 
stated  that  Grant  Thornton  has  a  zero-tolerance  policy  for  the  conduct  that  occurred  and 
that  they  would  reinforce  the  importance  of  exhibiting  ethical  behavior  at  the  next  local 
office  audit  training  and  as  part  of  their  annual  national  core  training.  She  also  stated 
they  will  consider  whether  there  are  changes  they  could  make  to  their  system  of  quality 
control  and  would  provide  this  information  by  September  15,  2013. 

Our  Response 

Grant  Thornton  comments  were  responsive  to  the  recommendation.  No  additional 
comments  are  needed. 
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Audit  Sample  Size  Determination 

The  auditors  did  not  adequately  plan  the  audit  because  they  did  not  assess  the  significance 
of  the  internal  control  being  tested  when  determining  the  size  of  the  audit  sample. 
Guidance  on  sampling  is  contained  in  "Government  Auditing  Standards  and  Circular  A- 1 3  3 
Audits"  (the  Audit  Guide]2  issued  by  the  American  Institute  of  Certified  Public  Accountants 
(AICPA).  The  guidance  provides  sampling  considerations,  including  an  assessment  of 
the  significance  of  the  internal  control,  to  ensure  that  the  sampling  approach  used  in  the 
single  audit  provides  sufficient  and  appropriate  evidence.  Grant  Thornton  auditors  did 
not  document  in  the  work  papers  an  assessment  of  the  significance  of  the  control  being 
tested  because  they  disagree  with  the  Audit  Guide  and  believe  its  policy  yields  a  sample 
size  sufficient  to  test  any  particular  control.  Due  to  the  lack  of  adequate  documentation, 
we  were  unable  to  conclude  that  the  sample  size  tested  provided  sufficient  evidence  to 
support  the  conclusions  on  the  operating  effectiveness  of  internal  controls. 


Sampling  Considerations 

Circular  A-133  requires  auditors  to  plan  the  testing  of  internal  control  over  major 
programs  to  support  a  low  assessed  level  of  control  risk  for  the  assertions  relevant  to 
the  compliance  requirements  for  each  major  program.  Chapter  11  of  the  Audit  Guide 
provides  considerations  in  designing  an  audit  approach  that  includes  audit  sampling  to 
achieve  both  compliance  and  internal  control  over  compliance  related  audit  objectives  in 
a  Circular  A-133  audit.  Specifically,  the  Audit  Guide  provides  suggested  minimum  sample 
sizes  designed  to  provide  sufficient  appropriate  audit  evidence  that  controls  are  operating 
effectively;  however,  the  guide  states  that  auditors  may  need  to  use  professional  judgment 
to  determine  if  larger  sample  sizes  are  warranted.  The  minimum  sample  sizes  identified 
in  the  Audit  Guide  (see  Table)  require  the  auditor  to  assess  both  the  inherent  risk  factors 
and  the  significance  of  the  control  being  tested  when  no  deviations3  are  expected. 


2  The  AICPA  Audit  Guide  is  an  interpretative  publication  issued  under  the  authority  of  the  Auditing  Standards  Board.  The 
members  of  the  Accounting  Standards  Board  have  found  the  auditing  guidance  to  be  consistent  with  existing  Statements 
on  Auditing  Standards. 

3  A  deviation  is  a  departure  from  the  expected  performance  of  the  prescribed  control. 
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Table.  AICPA  Audit  Guide  -  Control  Testing  Sample  Size 


Significance  of  Control  and  Inherent  Risk  of  Compliance 
Requirement 

Minimum  Sample  Size 
(0  deviations  expected) 

Very  significant  and  higher  inherent  risk 

60 

Very  significant  and  limited  inherent  risk 
or 

Moderately  significant  and  higher  inherent  risk 

40 

Moderately  significant  and  limited  inherent  risk 

25 

Grant  Thornton  auditors  documented  their  assessment  of  the  inherent  risk  factors  for 
each  of  the  compliance  requirements  but  did  not  assess  the  significance  of  the  control 
being  tested  because  they  followed  their  own  internal  policy  to  determine  the  size  of 
the  sample  selected  for  testing  internal  controls  and  compliance.  The  Grant  Thornton 
sampling  policy  states  that  a  sample  size  of  25  items  should  be  used  when  performing 
tests  of  controls  when  no  deviations  are  expected. 

Significance  of  Control 

The  Audit  Guide  states  that  the  auditor  should  use  the  information  gathered  by  performing 
the  risk  assessment  procedures  to  determine  the  nature,  timing,  and  extent  of  further 
audit  procedures  to  be  performed  for  each  control  selected  for  testing,  as  well  as  to  assist 
the  auditor  in  determining  the  significance  of  the  control.  All  controls  that  the  auditor 
determines  must  be  tested  to  mitigate  the  risk  of  material  noncompliance  are  significant 
controls,  but  a  spectrum  exists  as  to  the  significance  of  each  control.  Several  factors  may 
be  considered  in  determining  the  significance  level  of  a  control  including  the  potential 
magnitude  of  noncompliance  to  the  program  if  the  particular  control  were  to  fail  and 
the  number  of  controls  selected  for  testing.  For  instance,  if  payroll  was  a  large  portion 
of  expenditures  for  the  program,  the  internal  control  tested  would  likely  be  considered 
very  significant.  However,  if  the  auditor  planned  to  test  complementary,  compensating, 
or  redundant  controls  over  payroll,  each  control  would  more  likely  be  assessed  as 
moderately  significant. 

In  a  sampling  policy  memorandum  dated  August  18,  2011,  Grant  Thornton  states  that 
"the  opinion  expressed  does  not  depend  on  the  effectiveness  of  any  one  control,  rather 
efficient  sample  sizes  are  achieved  because  many  controls  are  tested  in  an  integrated 
audit,  and  other  tests  are  performed  in  a  financial  statement  or  compliance  audit."  Yet, 
for  the  Foundation’s  single  audit,  Grant  Thornton  limited  the  testing  to  one  key  control  for 
many  of  the  compliance  requirements.  When  only  one  control  is  selected  for  testing,  we 
generally  would  conclude  that  control  is  very  significant,  especially  without  documentation 
in  the  work  papers  to  indicate  otherwise.  Therefore,  Grant  Thornton  may  not  have  met 
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the  minimum  sample  sizes,  identified  in  the  Audit  Guide,  necessary  to  support  the  audit 
conclusions  that  the  Foundation's  internal  controls  were  operating  effectively. 

Grant  Thornton's  Sampling  Policy 

The  Grant  Thornton  policy  memorandum  does  not  agree  with  the  Audit  Guide  regarding 
an  assessment  of  the  significance  of  the  control  being  tested.  Grant  Thornton  stated  the 
Audit  Guide  inappropriately  focused  on  the  controls  as  if  the  objective  of  the  audit  was  to 
express  an  opinion  on  the  effectiveness  of  each  control  selected  for  testing.  Specifically, 
Grant  Thornton  stated  that  they  do  "not  apply  a  separate  risk  assessment  process  to 
each  control  selected  for  testing"  because  they  "believe  that  this  could  lead  the  auditor  to 
incorrectly  responding  to  the  risk  of  noncompliance  by  performing  more  control  testing 
when  the  risk  is  higher  rather  than  testing  compliance.”  In  effect,  Grant  Thornton  believes 
the  Audit  Guide  could  lead  the  auditor  to  perform  more  testing  on  controls  in  response 
to  the  assessed  risks  instead  of  increasing  the  testing  of  compliance  with  requirements. 
The  Grant  Thornton  policy  states  that  its  established  sampling  methodology  is  a  risk- 
based  approach  that  focuses  on  key  controls  and  yields  a  sample  size  of  25,  which  Grant 
Thornton  considers  sufficient  to  test  for  any  particular  control.  In  our  opinion,  Grant 
Thornton  incorrectly  interprets  the  Audit  Guide  as  focusing  on  internal  controls  rather 
than  providing  guidance  on  factors  that  should  be  addressed  to  ensure  the  sample  size 
selected  in  a  Circular  A-133  audit  will  provide  sufficient  appropriate  audit  evidence  that 
controls  are  operating  effectively.  The  determination  of  whether  controls  are  operating 
effectively  impacts  the  auditors’  determination  of  the  compliance  testing  sample  size 
necessary  to  support  the  overall  audit  opinion  on  compliance  with  requirements  on  the 
Federal  program. 

Although  Grant  Thornton  disagrees  with  several  points  made  in  the  guide,  disagreement 
is  not  a  sufficient  basis  for  not  following  the  guidance.  AICPA  interpretative  publications, 
including  the  Audit  Guide,  provide  recommendations  on  the  application  of  Statements 
on  Auditing  Standards  (SAS)  in  specific  circumstances.  If  an  auditor  does  not  apply 
the  auditing  guidance  included  in  an  applicable  interpretive  publication,  the  auditor  is 
required  to  explain  how  they  complied  with  the  SAS  provisions  addressed  by  the  auditing 
guidance.  In  its  policy  memorandum,  Grant  Thornton  stated  that  that  the  Audit  Guide 
presented  one  of  many  different  methodologies  that  could  be  developed  to  address  the 
number  of  occurrences  of  a  control  to  test.  However,  the  AICPA  added  Chapter  11  to 
the  Audit  Guide  specifically  to  address  the  wide  disparity  in  the  number  of  items  tested 
for  compliance  and  for  internal  control  over  compliance,  as  reported  in  the  President’s 
Council  on  Integrity  and  Efficiency  "Report  on  National  Single  Audit  Sampling  Project," 
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June  21,  2007.  Chapter  11  was  developed  by  a  task  force  comprised  of  a  wide  range  of 
auditors  having  expertise  in  performing  single  audits,  as  well  as  in  audit  sampling,  to 
provide  consistency  in  determining  the  number  of  transactions  tested,  and  in  documenting 
tests  performed  and  populations  from  which  they  are  drawn.  Therefore,  we  do  not  believe 
the  intent  of  the  Audit  Guide  was  to  provide  one  example  of  many  different  methodologies 
that  could  be  used  but  was  designed  to  ensure  sufficient  appropriate  evidence  is  obtained 
to  support  the  auditors’  conclusions  on  internal  control  and  compliance. 

Recommendations,  Management  Comments,  and  Our 
Response 

Recommendation  B.l 

We  recommend  that  the  National  Managing  Partner,  Professional  Standards  Group, 

Grant  Thornton,  LLP  revise  the  Grant  Thornton  sampling  policy  to  include  steps  on 
how  to  determine  and  document  the  significance  of  the  internal  controls  being  tested 
according  to  the  auditing  guidance  in  the  AICPA  Audit  Guide. 

Grant  Thornton  Comments 

The  National  Managing  Partner,  Professional  Standards  Group,  Grant  Thornton,  LLP,  stated 
that  Grant  Thornton  revised  its  sampling  policy  on  June  25,  2013  to  include  audit  steps 
to  determine  and  document  the  significance  of  the  internal  controls  that  are  identified 
for  testing  for  all  Circular  A-133  audits.  The  revisions  were  made  to  align  their  audit 
approach  with  the  most  recent  AICPA  Audit  Guide  and  were  effective  immediately. 

Our  Response 

Grant  Thornton  comments  were  responsive  to  the  recommendations.  No  additional 
comments  are  needed. 

Recommendation  B.2 

We  recommend  that  the  Audit  Partner,  Grant  Thornton,  LLP  assess  the  significance 
of  the  internal  controls  being  tested,  according  to  the  auditing  guidance  in  the 
AICPA  Audit  Guide,  when  determining  the  sample  sizes  for  the  FY  2011  Single  Audit  on 
the  Henry  M.  Jackson  Foundation  for  the  Advancement  of  Military  Medicine. 

Grant  Thornton  Comments 

The  National  Managing  Partner,  Professional  Standards  Group,  Grant  Thornton,  LLP, 
stated  that  the  Audit  Partner  and  engagement  team  were  assessing  the  significance 
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of  internal  controls  to  determine  the  sample  sizes  for  the  FY  2011  single  audit  on 
the  Henry  M.  Jackson  Foundation  for  the  Advancement  of  Military  Medicine.  This 
assessment  and  any  related  testing  of  additional  items,  is  expected  to  be  completed  by 
September  15,  2013. 

Our  Response 

Grant  Thornton  comments  were  responsive  to  the  recommendations.  No  additional 
comments  are  needed. 
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Appendix  A 

Quality  Control  Review  Process 

Criteria ,  Scope ;  and  Methodology 

The  Single  Audit  Act,  Public  Law  98-502,  as  amended,  was  enacted  to  improve  the 
financial  management  of  State  and  local  governments,  and  nonprofit  organizations  by 
establishing  a  uniform  set  of  auditing  and  reporting  requirements  for  all  Federal  award 
recipients  required  to  obtain  a  single  audit.  Circular  A-133  establishes  policies  that  guide 
the  implementation  of  the  Single  Audit  Act,  and  provides  an  administrative  foundation 
for  uniform  audit  requirements  of  non-Federal  entities  administering  Federal  awards. 
Entities  that  expend  $500,000  or  more  in  a  year  are  subject  to  the  Single  Audit  Act  and 
audit  requirements  in  Circular  A-133.  Therefore,  they  must  have  an  annual  single  or 
program-specific  audit  performed  in  accordance  with  government  auditing  standards 
and  submit  a  complete  reporting  package  to  the  Federal  Audit  Clearinghouse. 

We  performed  a  limited  review  of  the  Grant  Thornton,  LLP,  FY  2011  single  audit  of 
the  Foundation  and  the  reporting  package  that  was  submitted  to  the  Federal  Audit 
Clearinghouse  on  June  28,  2012,  using  the  2010  edition  of  the  "Guide  for  Quality  Control 
Reviews  of  OMB  Circular  Audits"  (the  Guide).  The  Guide  applies  to  any  single  audit  that 
is  subject  to  the  requirements  of  Circular  A-133  and  is  the  approved  Council  of  Inspectors 
General  on  Integrity  &  Efficiency  checklist  for  performing  quality  control  reviews. 

We  performed  our  review  from  January  2013  through  June  2013.  However,  we  were 
unable  to  complete  the  review  due  to  the  determination  that  some  of  the  Grant  Thornton 
work  papers,  and  therefore,  the  single  audit  opinion,  could  not  be  relied  on.  We  will 
reschedule  our  quality  control  review  once  the  additional  audit  work  is  completed  and 
the  audit  report  is  resubmitted  to  the  Federal  Audit  Clearinghouse. 

Prior  Quality  Control  Review 

Since  October  1,  2008,  we  performed  one  quality  control  review  of  Grant  Thornton, 
LLP  Circular  A-133  audits.  The  quality  control  review  identified  deficiencies  resulting 
in  findings  and  recommendations  on  the  Schedule  of  Expenditures  of  Federal 
Awards  and  audit  documentation.  Unrestricted  IG  DoD  reports  can  be  accessed  at 

http://www.dodig.mil/pubs/index.cfm?office=Audit  Policy  and  Oversight . 
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DoD  IG  Report 

Report  No.  2012-DoDIG-029,  "Report  on  Quality  Control  Review  of  Grant  Thornton,  LLP 
FY  2009  Single  Audit  of  Concurrent  Technologies  Corporation,"  December  5,  2011 
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Compliance  Requirements 


OMB  Circular  A-133  Compliance  Requirements 

Applicable 

Not  Applicable/ 
Not  Material 

Activities  Allowed/Unallowed 

X 

Allowable  Costs/Cost  Principles 

X 

Cash  Management 

X 

Davis-Bacon  Act 

X 

Eligibility 

X 

Equipment  and  Real  Property  Management 

X 

Matching,  Level  of  Effort,  Earmarking 

X 

Period  of  Availability  of  Federal  Funds 

X 

Procurement,  Suspension,  and  Debarment 

X 

Program  Income 

X 

Real  Property  Acquisition  and  Relocation  Assistance 

X 

Reporting 

X 

Subrecipient  Monitoring 

X 

Special  Tests  and  Provisions 

X 

Note:  This  chart  reflects  Grant  Thornton's  determination  of  the  compliance  requirements  that  are 
applicable  and  material  to  the  major  program. 
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Grant  Thornton,  LLP  Comments 


o  Grant  Thornton 


Grant  Thornton  LLP 

175  W  Jackson  Boulevard,  20th  Floor 
Chicago,  IL  60604-2687 

T  312.856.0200 

r  1  onu  F  312.565.4719 

July  31,  ZUI^  www.GrantThornton.com 


Randolph  R.  Stone 
Deputy  Inspector  General 
Policy  and  Oversight 
Department  of  Defense 
4800  Mark  Center  Drive 
Alexandria,  Virginia  22350 


Dear  Mr  Stone, 

Grant  Thornton  LLP  (or  the  Firm)  is  providing  responses  to  the  findings  and 
recommendations  in  the  letter  the  firm  received  dated  July  9,  2013  with  the  subject  “Report  on 
Quality  Control  Review  of  the  Grant  Thornton,  LLP,  FY  2011  Single  Audit  of  the  Henry  M. 
Jackson  Foundation  for  the  Advancement  of  Military  Medicine  (Project  No.  D201 3-DAPOSA- 
0079.000)”.  We  have  formatted  this  letter  to  include  your  findings/ recommendations  followed 
by  our  response. 

Finding  A  -  Performance  of  Federal  Program  Audit 

Grant  Thornton  reviewed  a  sample  of  transaction  items  to  evaluate  the  Foundation’s 
compliance  with  applicable  compliance  requirements.  We  performed  re-testing  of  several 
transaction  items  included  in  the  sample  to  determine  whether  the  audit  procedures  performed 
were  sufficient  to  support  audit  conclusions.  The  re-testing  consisted  of  examining  the  source 
documents  reviewed  by  the  Grant  Thornton  auditors.  As  a  result  of  our  analysis,  we  detected 
several  irregularities  and  requested  additional  information  and  clarification  from  Grant 
Thornton  auditors.  In  response  to  our  inquiries.  Grant  Thornton  performed  further  research 
and  determined  that  some  items  in  the  sample  were  not  part  of  the  Foundation’s  transactions 
for  FY  201 1 .  Grant  Thornton  informed  us  that  one  auditor  falsified  work  papers  by  copying 
transactions  from  the  prior  year  single  audit  and  changing  the  dates  of  the  transactions  to  make 
them  appear  to  be  FY  201 1  transactions.  These  false  transactions  were  included  in  the  sample 
used  for  several  compliance  requirements.  Due  to  the  seriousness  of  the  situation.  Grant 
Thornton  stated  that  they  were  investigating  the  matter,  had  terminated  the  auditor  who 
falsified  work  paper,  and  were  performing  additional  audit  work  to  support  its  audit  opinion  on 
the  Foundation’s  FY  201 1  single  audit. 


Grant  Thornton  LLP 

U.S.  member  firm  of  Grant  Thornton  International  Ud 
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Grant  Thornton,  LLP  Comments  (cont'd) 


o  Grant  Thornton 


Recommendation  A.  We  recommend  that  the  National  Managing  Partner,  Professional 
Standards  Group,  Grant  Thornton  LLP,  provide  the  DoD  Office  of  Inspector  General  with: 

Recommendation  A.1:  The  results  of  the  Grant  Thornton  investigation  into  the  matter  of  the 
falsified  work  papers. 

Grant  Thornton  Response:  We  will  provide  a  summary  of  the  results  of  the  investigation  into 
this  matter.  The  summary  will  be  provided  by  September  15,  2013. 

Recommendation  A.2.  A  list  of  all  Circular  A-133  audits  and  any  audits  impacting  DoD  on 
which  the  Grant  Thornton  auditor  who  falsified  work  papers  was  assigned. 

Recommendation  A.3.  The  role  of  the  auditor  and  any  specific  actions  taken  on  the  audit(s) 
identified  above. 

Grant  Thornton  Response  to  Recommendation  A.2.  and  A. 3.  We  agree  to  provide  the  name  of 
the  audit  clients  and  the  role  of  the  staff  auditor  on  those  engagements  but  request  that  this 
information  not  be  made  publicly  available  in  order  to  protect  the  confidentiality  of  Grant 
Thornton’s  clients.  This  information  will  be  provided  by  September  15,  2013  on  a  confidential 
basis. 

Recommendation  A.4.  Any  corrective  actions  taken,  including  changes  to  Grant  Thornton’s 
supervisory  review  process  and  overall  quality  control  procedures,  to  ensure  this  type  of 
situation  does  not  recur. 

Grant  Thornton  Response:  Grant  Thornton  consistently  emphasizes  to  all  personnel  that  they 
should  follow  the  firm’s  guiding  principles  in  everything  they  do.  At  the  beginning  of  national 
meetings  and  training  sessions,  the  guiding  principles  are  discussed.  Further,  the  firm  has  a 
Code  of  Conduct  which  each  professional  must  acknowledge.  As  a  firm,  we  demonstrate  a 
zero-tolerance  policy  for  this  type  of  conduct  and  the  individual  was  terminated  immediately. 
We  will  reinforce  the  importance  of  exhibiting  ethical  behaviour  in  everything  we  do  as  part  of 
the  next  local  office  audit  training  and  as  part  of  our  annual  national  core  training.  We  will  also 
consider  whether  there  are  changes  that  could  be  made  in  our  system  of  quality  control  that 
wrould  address  this  situation.  We  will  provide  a  summary  of  these  corrective  actions  taken  by 
September  15,  2013. 

Finding  B  -  Audit  Sample  Size  Determination 

The  auditors  did  not  adequately  plan  the  audit  because  they  did  not  assess  the  significance  of 
the  internal  control  being  tested  when  determining  the  size  of  the  audit  sample.  Guidance  on 
sampling  is  contained  in  “Government  Auditing  Standards  and  Circular  A-133  Audits”  (the 
Audit  Guide)  issued  by  the  American  Institute  of  Certified  Public  Accountants  (AICPA).  The 
guidance  provides  sampling  considerations,  including  an  assessment  of  the  significance  of  the 
internal  control,  to  ensure  that  the  sampling  approach  used  in  the  single  audit  provides 
sufficient  and  appropriate  evidence.  Grant  Thornton  auditors  did  not  document  in  the  work 
papers  an  assessment  of  the  significance  of  the  control  being  tested  because  they  disagree  with 


Grant  Thornton  LLP 

U.S,  member  firm  of  Gran!  Thornton  International  Ltd 
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Grant  Thornton,  LLP  Comments  (cont'd) 


Up  GrantThornton 


the  Audit  Guide  and  believe  its  policy  yields  a  sample  size  sufficient  to  test  any  particular 
control.  Due  to  the  lack  of  adequate  documentation,  we  were  unable  to  conclude  that  the 
sample  size  tested  provided  sufficient  evidence  to  support  the  conclusions  on  the  operating 
effectiveness  of  internal  controls. 

Recommendaton  B.l.  We  recommend  that  the  National  Managing  Partner,  Professional 
Standards  Group,  Grant  Thornton,  LLP  revise  the  Grant  Thornton  sampling  policy  to  include 
steps  on  how  to  determine  and  document  the  significance  of  the  internal  controls  being  tested 
according  to  the  auditing  guidance  in  the  AICPA  Audit  Guide. 

Grant  Thornton  Response:  On  June  25,  2013  the  Firm  revised  its  sampling  policy  to  include 
steps  for  audit  teams  to  determine  and  document  the  significance  of  the  internal  controls  that 
are  identified  for  testing  for  all  Circular  A-133  audits.  The  revisions  were  done  to  align  the 
Firm’s  audit  approach  with  the  most  recent  AICPA  Audit  Guide,  “Government  Auditing 
Standards  and  Circular  A-133  Audits.”  This  policy  was  effective  immediately,  including  in- 
process  engagements. 

Recommendation  B.2.  We  recommend  that  the  Audit  Partner,  Grant  Thornton,  LLP  assess 
the  significance  of  the  internal  controls  being  tested,  according  to  the  auditing  guidance  in  the 
AICPA  Audit  Guide,  when  determining  the  sample  sizes  for  the  FY  2011  Single  Audit  on  the 
Henry  M.  Jackson  Foundation  for  the  Advancement  of  Military  Medicine. 

Grant  Thornton  Response:  The  Audit  Partner  and  engagement  team  are  in  the  process  of 
assessing  the  significance  of  the  internal  controls  that  were  selected  for  testing  pursuant  to  the 
recommendations  included  in  the  report,  consistent  with  the  Firm’s  revised  policies,  to 
determine  the  sample  sizes  for  the  FY  2011  Single  Audit  on  the  Henry  M.  Jackson  Foundation 
for  the  Advancement  of  Military  Medicine.  This  assessment,  and  any  related  testing  of 
additional  items,  is  expected  to  be  completed  by  September  15,  2013. 

Sincerely, 

— -  C 'A - 

Karin  A.  French 

National  Managing  Partner  of  Professional  Standards 


Grant  Thornton  LLP 

U.S.  mamberflrm  of  Grant  Thornton  International  Ltd 
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Acronyms  and  Abbreviations 


Acronyms  and  Abbreviations 


AICPA  American  Institute  of  Certified  Public  Accountants 
OMB  Office  of  Management  and  Budget 
SAS  Statements  on  Auditing  Standards 
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Whistleblower  Protection 
U.S.  Department  of  Defense 


The  Whistleblower  Protection  Enhancement  Act  of  2012  requires 
the  Inspector  General  to  designate  a  Whistleblower  Protection 
Ombudsman  to  educate  agency  employees  about  prohibitions  on 
retaliation,  and  rights  and  remedies  against  retaliation  for  protected 
disclosures.  The  designated  ombudsman  is  the  DoD  IG  Director  for 
Whistleblowing  &  Transparency.  For  more  information  on  your  rights 
and  remedies  against  retaliation,  go  to  the  Whistleblower  webpage  at 
www.dodig.mil/programs/whistleblower. 


For  more  information  about  DoD  IG 
reports  or  activities,  please  contact  us: 

Congressional  Liaison 

Congressional@dodig.mil;  703.604.8324 

DoD  Hotline 

800.424.9098 

Media  Contact 

Public.Affairs@dodig.mil;  703.604.8324 

Monthly  Update 

dodigconnect-request@listserve.com 

Reports  Mailing  List 

dodig_report-request@listserve.com 

Twitter 

twitter.com/DoD_IG 


